✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and event.type == "start" and
  (
    (process.name : "reg.exe" and process.args : "query") or
    (
      process.name : ("powershell.exe", "powershell_ise.exe", "pwsh.exe") and
      process.args : ("get-childitem", "gci", "dir", "ls", "get-item", "gi", "get-itemproperty", "gp") and
      process.args : ("hkcu", "hkey_current_user", "hkey_local_machine", "hklm", "registry::*")
    )
  ) and
  not process.command_line : (
    "C:\\Windows\\system32\\reg.exe  query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64",
    "reg  query \"HKLM\\Software\\WOW6432Node\\Npcap\" /ve  "
  )